Factory Settings

ForensicIT_Dude · 2010-03-15T20:30:25Z

Hey everyone,So this is the case A good friend of mine had some problems with his laptop because he wasn't able to boot Windows anymore. He told me that he tried everything to get it to work. In the end he said that he restored Windows but all his files were gone.So I decided to take a look at his laptop and I saw that he set the laptop back to its factory settings. I wonder if there's any way to get his valuable files back. Because in theory all files on the drive are overwritten right? ( Thanks very much. wink

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by jaclaz 17 years ago

11 Posts

5 Users

0 Reactions

1,880 Views

RSS

jaclaz

(@jaclaz)

Illustrious Member

Joined: 19 years ago

Posts: 5133

17/03/2010 2:28 pm

This being the case, scrounge-ntfs is unlikely to work as it requires an active $MFT to work from

Not really.
It can also try to get from RAW MFT entries.
It's something worth a try anyway, before using photorec, which has obviously the limitation of losing filenames and not supporting "all" filetypes.

jaclaz

ReplyQuote

Page 2 / 2 Prev